{"id":102282,"date":"2021-08-05T08:56:06","date_gmt":"2021-08-05T15:56:06","guid":{"rendered":"https:\/\/www.backblaze.com\/blog\/?p=102282"},"modified":"2022-07-14T17:06:33","modified_gmt":"2022-07-15T00:06:33","slug":"cors-correction-developer-insight-on-the-backblaze-b2-command-line","status":"publish","type":"post","link":"https:\/\/www.backblaze.com\/blog\/cors-correction-developer-insight-on-the-backblaze-b2-command-line\/","title":{"rendered":"CORS Correction: Developer Insight on the Backblaze B2 Command Line"},"content":{"rendered":"

\"\"<\/p>\n

We recently spoke with Kristian Kielhofner, a developer and entrepreneur who’s on his third go-round as a startup founder and CEO after two very successful exits. He\u2019s built a next-gen, crypto-centric media asset management platform, Tovera, which launched two days ago.<\/p>\n

Developer customers are regularly choosing Backblaze B2 as the cloud storage platform that sits under their products and services. We feel lucky to learn about the innovations they are bringing to this world. Kristian found a clearer path to setting up CORS for B2 Cloud Storage and Cloudflare, so we asked him to share why he started Tovera, how he thought through his cloud storage options, and the exact steps he took to go live with his solution.\u2014Backblaze<\/p>\n<\/div>\n

The Tovera Backstory: Fighting Deepfakes<\/strong><\/h2>\n

One morning, this<\/a> story really caught my attention.<\/p>\n

Like many technology enthusiasts, I\u2019m familiar with deepfakes<\/a>. That said, the \u201cPennsylvania Cheerleading Mom\u201d story told me something: As we\u2019ve seen time and time again, technology rapidly evolves beyond its original intended use. Sometimes for our benefit, and (unfortunately) sometimes not so much…<\/p>\n

I realized it would only be a matter of time before this incredibly powerful technology would be in the hands of everyone\u2014for uses good or evil. With more research, I found that (not surprisingly) the current approach to stopping misuse of the technology utilizes the same fundamental machine learning approaches powering the deepfakes themselves. It seems that what we now have is a machine learning arms race: a new model to generate deepfakes, a new model to detect them<\/a>. Around and around we go.<\/p>\n

I began thinking of approaching the deepfake problem from the other side of the coin. What if, instead of using machine learning to guess what is fake, we prove what is real? Deepfake detection models can\u2019t provide 100% certainty today (or ever), but cryptographic authentication can. This simple idea was the genesis for Tovera<\/a>.<\/p>\n

What Does Tovera Do?<\/strong><\/h3>\n

Tovera takes digital media you upload and uses existing cryptography and emerging blockchain technology to create a 100% secure validation record. When published on our platform, we can confirm (with 100% certainty) that your digital media assets are yours and haven’t been tampered with.<\/p>\n

\"\"
Tovera asset upload and management page.<\/figcaption><\/figure>\n

After working through the initial proof of concept, I had another revelation: \u201cHey, while we\u2019re hitting our API whenever and wherever digital media is viewed, why don\u2019t we return some extra stuff?\u201d Now, not only can our users validate that their content is really theirs and hasn\u2019t been modified, they can use the features provided by Tovera Publish to dynamically update their released digital content from our dashboard. With Tovera, any changes you make to your digital media and online presence are updated across social media platforms, websites, and devices globally\u2014instantly.<\/p>\n

\"\"
An image served via Tovera, with authentication dropdown.<\/figcaption><\/figure>\n

In keeping with our mission of ensuring everyone can protect, validate, and control their online presence, we provide this technology for free with a simple sign up and onboarding process.<\/p>\n

The Tovera Storage Journey<\/strong><\/h2>\n

To provide this service, we needed to host the digital media files somewhere. Of course, you have your go-to juggernauts\u2014Amazon, Google, and Microsoft. The problem is Tovera is a tiny startup. Having some prior startup experience, I know that spending your money and time wisely from the beginning is one of the most important things you can do.<\/p>\n

I took one look at pricing from the \u201cbig three\u201d cloud providers through the lens of someone who has experience buying bandwidth and storage (long story) and I thought, \u201cWow, this is a good business.\u201d As has been covered on this blog<\/a> and elsewhere<\/a>, the storage and (especially) bandwidth markups from the big providers is, to put it mildly, significant.<\/p>\n

Like some of you, I\u2019ve also been a fan of Backblaze for a long time. Since it was announced, I\u2019ve kept an eye on their B2 Cloud Storage product. So, one morning I took it upon myself to give Backblaze B2 a try.<\/p>\n

Sign up and initial onboarding couldn\u2019t have been easier. I found myself in the Backblaze B2 user dashboard up and running in no time. Creating application keys<\/a> for my purposes was also extremely easy.<\/p>\n

After deciding B2 Cloud Storage would work in theory, I decided to try it out in practice. As I integrated the service into Tovera, I ran into a few different vexing issues. I thought other devs might be able to benefit from my CORS troubleshooting, and so I\u2019m outlining my experience here.<\/p>\n

Checking the Backblaze S3 Compatible API<\/strong><\/h3>\n

We make it simple for our users to upload their assets directly to our cloud storage provider. Because B2 Cloud Storage has the Backblaze S3 Compatible API, the use of presigned URLs fits the bill. This way, Tovera users can upload their digital media assets directly to Backblaze, securely, and make them available to the world via our platform.<\/p>\n

In case you\u2019re not familiar with the presigned URL process, the overall flow looks something like the structure laid out in this blog post<\/a>.<\/p>\n

After perusing the available documentation, I started off with the following Node.js Javascript code:<\/p>\n

\"\"<\/p>\n

With this Javascript function, Tovera API services provide a URL for our user dashboard to instantly (and securely) upload their assets to our Backblaze account. I had read Backblaze B2 has a 100% Amazon S3 Compatible API but I was a little skeptical. Is this really going to work? Sure enough, it worked on the first attempt!<\/p>\n

Integrating Cloudflare and Setting Up CORS<\/strong><\/h3>\n

Between the Bandwidth Alliance and having dealt with DDoS attacks and shady internet stuff in general before, I\u2019m also a big fan of Cloudflare<\/a>. Fortunately, Backblaze provides guidance<\/a> on how to best use B2 Cloud Storage with Cloudflare to make use of their combined power.<\/p>\n

Once I set up Cloudflare to work with B2 Cloud Storage and the Tovera API services were returning valid, presigned URLs for clients to do a direct HTTP PUT, I tried it out in our Next.js-powered user dashboard.<\/p>\n

Uh-oh. Dreaded CORS errors. I\u2019ll spare you the details, but here\u2019s where things get interesting\u2026 I don\u2019t know about you, but CORS can be a little frustrating. LONG story short, I dug in deep, feeling a little like I was wandering around a dark room looking for the light switch.<\/p>\n

After fumbling around a bit, I was able to piece together the following with the Backblaze B2 command line utility<\/a>:<\/p>\n

\"\"<\/p>\n

With this usage of the Backblaze B2 command line utility, we\u2019re setting the following CORS rules on our bucket:<\/p>\n